sliccy 6.128.6 → 6.128.7

package/dist/node-server/_shared/content-type.d.ts

@@ -1,3 +1,27 @@
 /** Check whether a content type is safe to decode as UTF-8 text. */
 export declare function isTextContentType(contentType: string): boolean;
+/**
+ * Whether a content type is `application/x-www-form-urlencoded`.
+ *
+ * Callers need this on top of {@link isTextRequestContentType} because a form
+ * body is not just text: substituting a secret into one has to respect the
+ * percent-encoding (see `unmaskFormBody`).
+ */
+export declare function isFormContentType(contentType: string): boolean;
+/**
+ * Request-side variant of {@link isTextContentType}, additionally matching
+ * `application/x-www-form-urlencoded`.
+ *
+ * Form bodies carry secrets — OAuth token exchange and a long tail of provider
+ * APIs POST `client_secret=…` / `token=…` as a form — so a masked token in one
+ * MUST be unmasked before the proxy forwards it upstream. The plain predicate
+ * stays urlencoded-free because it also gates response scrub and body caching,
+ * where a form body is rare and the extra match buys nothing.
+ *
+ * Mirrored by `isTextRequestContentType` in
+ * `packages/swift-server/Sources/Server/ContentType.swift`; the classification
+ * table is pinned in both `tests/cross-impl-vectors.test.ts` and
+ * `packages/swift-server/Tests/CrossImplementationTests.swift`.
+ */
+export declare function isTextRequestContentType(contentType: string): boolean;
 //# sourceMappingURL=content-type.d.ts.map

package/dist/node-server/_shared/content-type.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"content-type.d.ts","sourceRoot":"","sources":["../src/content-type.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAa9D"}
+{"version":3,"file":"content-type.d.ts","sourceRoot":"","sources":["../src/content-type.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAa9D;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAG9D;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,wBAAwB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAGrE"}

package/dist/node-server/_shared/content-type.js

@@ -12,4 +12,36 @@ export function isTextContentType(contentType) {
         normalized.includes('css') ||
         normalized.includes('svg'));
 }
+/**
+ * Whether a content type is `application/x-www-form-urlencoded`.
+ *
+ * Callers need this on top of {@link isTextRequestContentType} because a form
+ * body is not just text: substituting a secret into one has to respect the
+ * percent-encoding (see `unmaskFormBody`).
+ */
+export function isFormContentType(contentType) {
+    if (!contentType)
+        return false;
+    return contentType.toLowerCase().includes('urlencoded');
+}
+/**
+ * Request-side variant of {@link isTextContentType}, additionally matching
+ * `application/x-www-form-urlencoded`.
+ *
+ * Form bodies carry secrets — OAuth token exchange and a long tail of provider
+ * APIs POST `client_secret=…` / `token=…` as a form — so a masked token in one
+ * MUST be unmasked before the proxy forwards it upstream. The plain predicate
+ * stays urlencoded-free because it also gates response scrub and body caching,
+ * where a form body is rare and the extra match buys nothing.
+ *
+ * Mirrored by `isTextRequestContentType` in
+ * `packages/swift-server/Sources/Server/ContentType.swift`; the classification
+ * table is pinned in both `tests/cross-impl-vectors.test.ts` and
+ * `packages/swift-server/Tests/CrossImplementationTests.swift`.
+ */
+export function isTextRequestContentType(contentType) {
+    if (!contentType)
+        return false;
+    return isTextContentType(contentType) || isFormContentType(contentType);
+}
 //# sourceMappingURL=content-type.js.map

package/dist/node-server/_shared/content-type.js.map

@@ -1 +1 @@
-{"version":3,"file":"content-type.js","sourceRoot":"","sources":["../src/content-type.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,MAAM,UAAU,iBAAiB,CAAC,WAAmB;IACnD,IAAI,CAAC,WAAW;QAAE,OAAO,KAAK,CAAC;IAC/B,MAAM,UAAU,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC;IAC7C,OAAO,CACL,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC;QAC9B,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC3B,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC;QAC1B,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC;QACjC,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC;QACjC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC3B,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC;QAC1B,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAC3B,CAAC;AACJ,CAAC"}
+{"version":3,"file":"content-type.js","sourceRoot":"","sources":["../src/content-type.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,MAAM,UAAU,iBAAiB,CAAC,WAAmB;IACnD,IAAI,CAAC,WAAW;QAAE,OAAO,KAAK,CAAC;IAC/B,MAAM,UAAU,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC;IAC7C,OAAO,CACL,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC;QAC9B,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC3B,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC;QAC1B,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC;QACjC,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC;QACjC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC3B,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC;QAC1B,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAC3B,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,WAAmB;IACnD,IAAI,CAAC,WAAW;QAAE,OAAO,KAAK,CAAC;IAC/B,OAAO,WAAW,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,wBAAwB,CAAC,WAAmB;IAC1D,IAAI,CAAC,WAAW;QAAE,OAAO,KAAK,CAAC;IAC/B,OAAO,iBAAiB,CAAC,WAAW,CAAC,IAAI,iBAAiB,CAAC,WAAW,CAAC,CAAC;AAC1E,CAAC"}

package/dist/node-server/_shared/form-body-unmask.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Encoding-aware masked→real unmask for `application/x-www-form-urlencoded`
+ * request bodies.
+ *
+ * A form body is text, so the naive path is a substring replace of the masked
+ * token with the real value. That corrupts the body whenever the real secret
+ * contains a character that is reserved in a form: `&` and `=` split one field
+ * into two (or inject an attacker-shaped extra parameter), `+` is decoded
+ * upstream as a space, and a bare `%` becomes a malformed escape. Base64
+ * secrets — AWS keys, many OAuth client secrets — routinely contain `+`, `/`,
+ * and `=`, so the naive path silently breaks exactly the token exchanges that
+ * made form unmasking necessary in the first place.
+ *
+ * This walks the body field by field, unmasks each value in its DECODED form,
+ * and re-encodes only the values that actually changed. Untouched fields keep
+ * their original bytes, so a body with no masked token is forwarded verbatim.
+ *
+ * Same shape as `SecretsPipeline.unmaskAuthorizationBasic`, which decodes
+ * base64, unmasks, and re-encodes rather than substituting into the wire form.
+ *
+ * Mirrored by `unmaskFormBody` in
+ * `packages/swift-server/Sources/Server/FormBodyUnmask.swift`; the
+ * substitution table is pinned in both cross-impl test files.
+ */
+import type { SecretsPipeline } from './secrets-pipeline.js';
+/** The unmask surface this helper needs — `SecretsPipeline` or a wrapper over one. */
+export type FormBodyUnmasker = Pick<SecretsPipeline, 'unmaskBody' | 'hasSecrets'>;
+/**
+ * Unmask a form-urlencoded body. Returns the original string when nothing
+ * changed, so the caller can skip re-encoding the buffer.
+ */
+export declare function unmaskFormBody(pipeline: FormBodyUnmasker, body: string, hostname: string): {
+    text: string;
+};
+//# sourceMappingURL=form-body-unmask.d.ts.map

package/dist/node-server/_shared/form-body-unmask.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"form-body-unmask.d.ts","sourceRoot":"","sources":["../src/form-body-unmask.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAE7D,sFAAsF;AACtF,MAAM,MAAM,gBAAgB,GAAG,IAAI,CAAC,eAAe,EAAE,YAAY,GAAG,YAAY,CAAC,CAAC;AAyBlF;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,gBAAgB,EAC1B,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,GACf;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CA6BlB"}

package/dist/node-server/_shared/form-body-unmask.js

@@ -0,0 +1,81 @@
+/**
+ * Encoding-aware masked→real unmask for `application/x-www-form-urlencoded`
+ * request bodies.
+ *
+ * A form body is text, so the naive path is a substring replace of the masked
+ * token with the real value. That corrupts the body whenever the real secret
+ * contains a character that is reserved in a form: `&` and `=` split one field
+ * into two (or inject an attacker-shaped extra parameter), `+` is decoded
+ * upstream as a space, and a bare `%` becomes a malformed escape. Base64
+ * secrets — AWS keys, many OAuth client secrets — routinely contain `+`, `/`,
+ * and `=`, so the naive path silently breaks exactly the token exchanges that
+ * made form unmasking necessary in the first place.
+ *
+ * This walks the body field by field, unmasks each value in its DECODED form,
+ * and re-encodes only the values that actually changed. Untouched fields keep
+ * their original bytes, so a body with no masked token is forwarded verbatim.
+ *
+ * Same shape as `SecretsPipeline.unmaskAuthorizationBasic`, which decodes
+ * base64, unmasks, and re-encodes rather than substituting into the wire form.
+ *
+ * Mirrored by `unmaskFormBody` in
+ * `packages/swift-server/Sources/Server/FormBodyUnmask.swift`; the
+ * substitution table is pinned in both cross-impl test files.
+ */
+/**
+ * Percent-decode one form component. `+` means space in a form body, so it is
+ * promoted to `%20` before decoding. Returns `null` for a malformed escape,
+ * which the caller treats as "cannot reason about this field's encoding".
+ */
+function decodeFormComponent(raw) {
+    try {
+        return decodeURIComponent(raw.replace(/\+/g, '%20'));
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Percent-encode one form component. `encodeURIComponent` escapes every
+ * character that is reserved in a form body and leaves only unreserved ones
+ * (`A-Za-z0-9-_.!~*'()`), all of which are legal in a form value. Space becomes
+ * `%20` rather than `+`; both decode to a space.
+ */
+function encodeFormComponent(value) {
+    return encodeURIComponent(value);
+}
+/**
+ * Unmask a form-urlencoded body. Returns the original string when nothing
+ * changed, so the caller can skip re-encoding the buffer.
+ */
+export function unmaskFormBody(pipeline, body, hostname) {
+    if (!body || !pipeline.hasSecrets())
+        return { text: body };
+    let changed = false;
+    const fields = body.split('&').map((field) => {
+        const eq = field.indexOf('=');
+        const name = eq < 0 ? '' : field.slice(0, eq + 1);
+        const rawValue = eq < 0 ? field : field.slice(eq + 1);
+        if (!rawValue)
+            return field;
+        const decoded = decodeFormComponent(rawValue);
+        if (decoded === null) {
+            // Malformed percent-escape: the field's encoding is not interpretable, so
+            // fall back to the legacy substring replace rather than dropping the
+            // secret. Best-effort — a reserved character in the real value can still
+            // corrupt a field this broken.
+            const { text } = pipeline.unmaskBody(rawValue, hostname);
+            if (text === rawValue)
+                return field;
+            changed = true;
+            return `${name}${text}`;
+        }
+        const { text } = pipeline.unmaskBody(decoded, hostname);
+        if (text === decoded)
+            return field;
+        changed = true;
+        return `${name}${encodeFormComponent(text)}`;
+    });
+    return { text: changed ? fields.join('&') : body };
+}
+//# sourceMappingURL=form-body-unmask.js.map

package/dist/node-server/_shared/form-body-unmask.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"form-body-unmask.js","sourceRoot":"","sources":["../src/form-body-unmask.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAOH;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,GAAW;IACtC,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,mBAAmB,CAAC,KAAa;IACxC,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;AACnC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAC5B,QAA0B,EAC1B,IAAY,EACZ,QAAgB;IAEhB,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAE3D,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QAC3C,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,IAAI,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;QAClD,MAAM,QAAQ,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QACtD,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QAE5B,MAAM,OAAO,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QAC9C,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,0EAA0E;YAC1E,qEAAqE;YACrE,yEAAyE;YACzE,+BAA+B;YAC/B,MAAM,EAAE,IAAI,EAAE,GAAG,QAAQ,CAAC,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YACzD,IAAI,IAAI,KAAK,QAAQ;gBAAE,OAAO,KAAK,CAAC;YACpC,OAAO,GAAG,IAAI,CAAC;YACf,OAAO,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;QAC1B,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,GAAG,QAAQ,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACxD,IAAI,IAAI,KAAK,OAAO;YAAE,OAAO,KAAK,CAAC;QACnC,OAAO,GAAG,IAAI,CAAC;QACf,OAAO,GAAG,IAAI,GAAG,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACrD,CAAC"}

package/dist/node-server/_shared/index.d.ts

@@ -5,6 +5,7 @@ export * from './cdp-frame-unmask.js';
 export * from './content-type.js';
 export * from './electron-overlay-route.js';
 export * from './fetch-proxy-protocol.js';
+export * from './form-body-unmask.js';
 export * from './loopback.js';
 export * from './oauth-extra-domains-storage.js';
 export * from './preview-url.js';

package/dist/node-server/_shared/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,cAAc,uBAAuB,CAAC;AACtC,cAAc,aAAa,CAAC;AAC5B,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,mBAAmB,CAAC;AAClC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,eAAe,CAAC;AAC9B,cAAc,kCAAkC,CAAC;AACjD,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,wBAAwB,CAAC;AACvC,cAAc,qBAAqB,CAAC;AACpC,cAAc,uBAAuB,CAAC;AACtC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,uBAAuB,CAAC;AACtC,cAAc,YAAY,CAAC;AAC3B,cAAc,oBAAoB,CAAC;AACnC,cAAc,wBAAwB,CAAC;AACvC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,qBAAqB,CAAC;AACpC,cAAc,yBAAyB,CAAC;AACxC,cAAc,sBAAsB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,cAAc,uBAAuB,CAAC;AACtC,cAAc,aAAa,CAAC;AAC5B,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,mBAAmB,CAAC;AAClC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,uBAAuB,CAAC;AACtC,cAAc,eAAe,CAAC;AAC9B,cAAc,kCAAkC,CAAC;AACjD,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,wBAAwB,CAAC;AACvC,cAAc,qBAAqB,CAAC;AACpC,cAAc,uBAAuB,CAAC;AACtC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,uBAAuB,CAAC;AACtC,cAAc,YAAY,CAAC;AAC3B,cAAc,oBAAoB,CAAC;AACnC,cAAc,wBAAwB,CAAC;AACvC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,qBAAqB,CAAC;AACpC,cAAc,yBAAyB,CAAC;AACxC,cAAc,sBAAsB,CAAC"}

package/dist/node-server/_shared/index.js

@@ -6,6 +6,7 @@ export * from './cdp-frame-unmask.js';
 export * from './content-type.js';
 export * from './electron-overlay-route.js';
 export * from './fetch-proxy-protocol.js';
+export * from './form-body-unmask.js';
 export * from './loopback.js';
 export * from './oauth-extra-domains-storage.js';
 export * from './preview-url.js';

package/dist/node-server/_shared/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,iFAAiF;AAEjF,cAAc,uBAAuB,CAAC;AACtC,cAAc,aAAa,CAAC;AAC5B,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,mBAAmB,CAAC;AAClC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,eAAe,CAAC;AAC9B,cAAc,kCAAkC,CAAC;AACjD,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,wBAAwB,CAAC;AACvC,cAAc,qBAAqB,CAAC;AACpC,cAAc,uBAAuB,CAAC;AACtC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,uBAAuB,CAAC;AACtC,cAAc,YAAY,CAAC;AAC3B,cAAc,oBAAoB,CAAC;AACnC,cAAc,wBAAwB,CAAC;AACvC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,qBAAqB,CAAC;AACpC,cAAc,yBAAyB,CAAC;AACxC,cAAc,sBAAsB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,iFAAiF;AAEjF,cAAc,uBAAuB,CAAC;AACtC,cAAc,aAAa,CAAC;AAC5B,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,mBAAmB,CAAC;AAClC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,uBAAuB,CAAC;AACtC,cAAc,eAAe,CAAC;AAC9B,cAAc,kCAAkC,CAAC;AACjD,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,wBAAwB,CAAC;AACvC,cAAc,qBAAqB,CAAC;AACpC,cAAc,uBAAuB,CAAC;AACtC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,uBAAuB,CAAC;AACtC,cAAc,YAAY,CAAC;AAC3B,cAAc,oBAAoB,CAAC;AACnC,cAAc,wBAAwB,CAAC;AACvC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,qBAAqB,CAAC;AACpC,cAAc,yBAAyB,CAAC;AACxC,cAAc,sBAAsB,CAAC"}

package/dist/node-server/routes/fetch-proxy.js

@@ -1,6 +1,6 @@
 import { Readable, Transform } from 'node:stream';
 import { StringDecoder } from 'node:string_decoder';
-import { HMAC_SIGN_HEADER, isLoopbackOrigin, isTextContentType } from '../_shared/index.js';
+import { HMAC_SIGN_HEADER, isFormContentType, isLoopbackOrigin, isTextContentType, isTextRequestContentType, unmaskFormBody, } from '../_shared/index.js';
 import { buildFetchProxyExposeHeaders, FETCH_PROXY_CONTENT_LENGTH_HEADER, FETCH_PROXY_SKIP_HEADERS, FETCH_PROXY_SKIP_RESPONSE_HEADERS, FETCH_PROXY_SKIP_RESPONSE_PREFIXES, } from '../fetch-proxy-headers.js';
 import { AgentActivityTracker, registerAgentActivityRoute } from './agent-activity.js';
 /** Pick the first value of a possibly-multi-valued request header. */
@@ -124,14 +124,23 @@ async function applyHmacSigning(secretProxy, headers, hmacSpec, body, targetHost
  * Unmask masked secrets in a text request body. Non-text bodies (git
  * packfiles, octet-stream, images, …) are left untouched — `toString('utf-8')`
  * on arbitrary bytes corrupts them, and masked values never appear in binary.
+ *
+ * Uses the request-side predicate so form POSTs count as text: swift-server
+ * unmasks them and a masked `client_secret` reaching an upstream OAuth token
+ * endpoint verbatim is a silent auth failure, not a corrupt-bytes risk (#2821).
+ * A form body then takes the encoding-aware `unmaskFormBody` path — a plain
+ * substring splice would corrupt it whenever the real secret carries a
+ * form-reserved character (base64 `+` / `/` / `=`).
  */
 function unmaskRequestBody(secretProxy, headers, rawBody, targetHostname) {
     const contentType = headers['content-type'] ?? headers['Content-Type'] ?? '';
-    if (isTextContentType(contentType) && secretProxy.hasSecrets()) {
-        const bodyResult = secretProxy.unmaskBody(rawBody.toString('utf-8'), targetHostname);
-        return Buffer.from(bodyResult.text, 'utf-8');
-    }
-    return rawBody;
+    if (!isTextRequestContentType(contentType) || !secretProxy.hasSecrets())
+        return rawBody;
+    const body = rawBody.toString('utf-8');
+    const { text } = isFormContentType(contentType)
+        ? unmaskFormBody(secretProxy, body, targetHostname)
+        : secretProxy.unmaskBody(body, targetHostname);
+    return text === body ? rawBody : Buffer.from(text, 'utf-8');
 }
 /**
  * Forward the upstream status + response headers, stripping hop-by-hop and